@spinabot/brigade 0.1.2 → 1.0.1

package/dist/agents/cmd-ism-guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Cmd-ism guard — refuses `bash` / `exec` / `shell` / `sh` commands that
+ * redirect into a reserved MS-DOS device name (`nul`, `con`, `prn`,
+ * `aux`, `com1-9`, `lpt1-9`).
+ *
+ * Why this exists
+ * ---------------
+ * Models that know the host is Windows sometimes emit cmd.exe idioms
+ * into the POSIX bash tool — most commonly `2>nul` / `>nul 2>&1` to
+ * discard output. In cmd.exe `nul` is the null device; in bash it is a
+ * plain filename, so the redirect silently creates a real, 0-byte file
+ * named `nul` in the session cwd. On Windows that file is then
+ * untouchable through normal APIs (Explorer fails the containing
+ * folder's deletion with "Invalid MS-DOS function") — it can only be
+ * removed via a `\\?\` raw path. This happened in production: an agent
+ * ran `where magick 2>nul || ...` and left `~/.brigade/workspace/nul`
+ * behind, bricking folder deletion for the operator.
+ *
+ * The redirect is the only cmd-ism worth guarding: other cmd-isms
+ * (`where`, `del`, `copy`) fail loudly in bash and the model
+ * self-corrects from stderr, but a `2>nul` redirect *appears to
+ * succeed* while leaving a toxic artifact.
+ *
+ * Scope
+ * -----
+ * Exact device names only (`> nul`, `2>nul`, `>> NUL`, `> tmp/nul`).
+ * Windows also reserves the names with extensions (`nul.txt`), but the
+ * model never emits those as a discard target — kept out to avoid
+ * false positives. Quoted spans are stripped before matching so a
+ * command that merely *mentions* `2>nul` in a string (e.g. writing
+ * docs about cmd.exe) passes through. Heuristic by design, same
+ * philosophy as the path-write guard.
+ */
+import type { BrigadeBeforeToolCallHook } from "./tool-guard.js";
+/**
+ * Returns the offending redirect target (e.g. `nul`) when the command
+ * redirects into a reserved device name, else `undefined`.
+ */
+export declare function detectDeviceRedirect(command: string): string | undefined;
+/**
+ * Build the cmd-ism guard hook. Wire AFTER the path-write guard (both
+ * are structural "is this call even legal" checks; path legality first)
+ * and BEFORE the loop detector + exec-gate, so the operator is never
+ * asked to approve a command that would brick their state dir.
+ */
+export declare function makeCmdIsmGuard(): BrigadeBeforeToolCallHook;
+//# sourceMappingURL=cmd-ism-guard.d.ts.map

package/dist/agents/cmd-ism-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmd-ism-guard.d.ts","sourceRoot":"","sources":["../../src/agents/cmd-ism-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AA4BjE;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,yBAAyB,CA0B3D"}

package/dist/agents/cmd-ism-guard.js

@@ -0,0 +1,100 @@
+/**
+ * Cmd-ism guard — refuses `bash` / `exec` / `shell` / `sh` commands that
+ * redirect into a reserved MS-DOS device name (`nul`, `con`, `prn`,
+ * `aux`, `com1-9`, `lpt1-9`).
+ *
+ * Why this exists
+ * ---------------
+ * Models that know the host is Windows sometimes emit cmd.exe idioms
+ * into the POSIX bash tool — most commonly `2>nul` / `>nul 2>&1` to
+ * discard output. In cmd.exe `nul` is the null device; in bash it is a
+ * plain filename, so the redirect silently creates a real, 0-byte file
+ * named `nul` in the session cwd. On Windows that file is then
+ * untouchable through normal APIs (Explorer fails the containing
+ * folder's deletion with "Invalid MS-DOS function") — it can only be
+ * removed via a `\\?\` raw path. This happened in production: an agent
+ * ran `where magick 2>nul || ...` and left `~/.brigade/workspace/nul`
+ * behind, bricking folder deletion for the operator.
+ *
+ * The redirect is the only cmd-ism worth guarding: other cmd-isms
+ * (`where`, `del`, `copy`) fail loudly in bash and the model
+ * self-corrects from stderr, but a `2>nul` redirect *appears to
+ * succeed* while leaving a toxic artifact.
+ *
+ * Scope
+ * -----
+ * Exact device names only (`> nul`, `2>nul`, `>> NUL`, `> tmp/nul`).
+ * Windows also reserves the names with extensions (`nul.txt`), but the
+ * model never emits those as a discard target — kept out to avoid
+ * false positives. Quoted spans are stripped before matching so a
+ * command that merely *mentions* `2>nul` in a string (e.g. writing
+ * docs about cmd.exe) passes through. Heuristic by design, same
+ * philosophy as the path-write guard.
+ */
+/** Tool names whose `command` arg we scan (matches path-write-guard). */
+const BASH_TOOL_NAMES = new Set(["bash", "exec", "shell", "sh"]);
+/** Extract the `command` string from a bash-shaped tool call. */
+function extractBashCommand(args) {
+    if (!args || typeof args !== "object")
+        return undefined;
+    const bag = args;
+    const raw = bag.command ?? bag.cmd ?? bag.script;
+    return typeof raw === "string" ? raw : undefined;
+}
+/**
+ * Redirect into a reserved DOS device name:
+ *   - optional fd digits (`2>`, `1>`), `>` or `>>`, optional whitespace
+ *   - optional path prefix (`tmp/nul` creates the same toxic file)
+ *   - the device name, terminated by end-of-string or a shell delimiter
+ *
+ * `2>&1` never matches — `&` is not a valid target character.
+ */
+const DEVICE_REDIRECT = /(?:^|[\s;&|()])\d*>{1,2}\s*((?:[^\s;&|<>"']*[\\/])?(?:nul|con|prn|aux|com[1-9]|lpt[1-9]))(?=$|[\s;&|<>)])/i;
+/** Drop quoted spans so string literals mentioning `2>nul` don't trip the guard. */
+function stripQuotedSpans(command) {
+    return command.replace(/'[^']*'/g, " ").replace(/"[^"]*"/g, " ");
+}
+/**
+ * Returns the offending redirect target (e.g. `nul`) when the command
+ * redirects into a reserved device name, else `undefined`.
+ */
+export function detectDeviceRedirect(command) {
+    if (!command || !command.trim())
+        return undefined;
+    const match = stripQuotedSpans(command).match(DEVICE_REDIRECT);
+    return match?.[1];
+}
+/**
+ * Build the cmd-ism guard hook. Wire AFTER the path-write guard (both
+ * are structural "is this call even legal" checks; path legality first)
+ * and BEFORE the loop detector + exec-gate, so the operator is never
+ * asked to approve a command that would brick their state dir.
+ */
+export function makeCmdIsmGuard() {
+    return async (ctx) => {
+        const rawName = ctx?.toolCall?.name
+            ?? ctx?.name
+            ?? "";
+        const name = typeof rawName === "string" ? rawName.trim().toLowerCase() : "";
+        if (!BASH_TOOL_NAMES.has(name))
+            return undefined;
+        const args = ctx
+            ?.toolCall?.arguments
+            ?? ctx?.arguments
+            ?? ctx?.args
+            ?? {};
+        const command = extractBashCommand(args);
+        if (!command)
+            return undefined;
+        const target = detectDeviceRedirect(command);
+        if (!target)
+            return undefined;
+        return {
+            block: true,
+            reason: `bash: refusing redirect into \`${target}\` — that is a cmd.exe idiom, but this tool runs a POSIX shell ` +
+                `where \`${target}\` is a plain filename. The redirect would create a real file with a reserved DOS device ` +
+                `name, which Windows file APIs then cannot delete. Use \`/dev/null\` to discard output (e.g. \`2>/dev/null\`).`,
+        };
+    };
+}
+//# sourceMappingURL=cmd-ism-guard.js.map

package/dist/agents/cmd-ism-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmd-ism-guard.js","sourceRoot":"","sources":["../../src/agents/cmd-ism-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,GAAG,GAAG,IAA8D,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;IACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,4GAA4G,CAAC;AAErI,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,OAAe;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC9B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAI,GAAyD,EAAE,QAAQ,EAAE,IAAI;eACrF,GAA0B,EAAE,IAAI;eACjC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjD,MAAM,IAAI,GAAI,GAAmF;YAChG,EAAE,QAAQ,EAAE,SAAS;eACjB,GAA+B,EAAE,SAAS;eAC1C,GAA0B,EAAE,IAAI;eACjC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO;YACN,KAAK,EAAE,IAAI;YACX,MAAM,EACL,kCAAkC,MAAM,iEAAiE;gBACzG,WAAW,MAAM,2FAA2F;gBAC5G,+GAA+G;SACjF,CAAC;IAClC,CAAC,CAAC;AACH,CAAC"}

package/dist/agents/config-write-guard.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Config-write guard — refuses bash commands that would MUTATE Brigade's
+ * state files (`~/.brigade/brigade.json`, credential stores, approvals,
+ * encryption key, cron store).
+ *
+ * Why (production, 2026-06-11): asked to tweak the org's A2A mode, the
+ * model piped brigade.json through an inline python script and wrote it
+ * back. The operator approved the prompt without realizing it was a config
+ * WRITE; the script silently no-op'd (declared success, changed nothing),
+ * and only forensics caught it. A different bug in the same shape could
+ * have corrupted the whole install. `write`/`edit` are already guarded by
+ * the path-write guard — bash + python/sed/tee was the remaining hole.
+ *
+ * Boundary semantics (the operator's explicit ask): the agent may READ
+ * state files through the shell (discouraged — the tools report this state
+ * already), but every MUTATION must go through the proper tool surface
+ * (org / manage_provider / manage_agent / manage_skill / cron) or be
+ * handed to the operator as an exact suggested edit. The refusal text
+ * carries that remedy so the model course-corrects in one step.
+ */
+import type { BrigadeBeforeToolCallHook } from "./tool-guard.js";
+/** Exposed for tests: classify a command. Returns the matched indicator or null. */
+export declare function detectConfigWrite(command: string): string | null;
+export declare function makeConfigWriteGuard(): BrigadeBeforeToolCallHook;
+//# sourceMappingURL=config-write-guard.d.ts.map

package/dist/agents/config-write-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-write-guard.d.ts","sourceRoot":"","sources":["../../src/agents/config-write-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAsCjE,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMhE;AAED,wBAAgB,oBAAoB,IAAI,yBAAyB,CAkChE"}

package/dist/agents/config-write-guard.js

@@ -0,0 +1,95 @@
+/**
+ * Config-write guard — refuses bash commands that would MUTATE Brigade's
+ * state files (`~/.brigade/brigade.json`, credential stores, approvals,
+ * encryption key, cron store).
+ *
+ * Why (production, 2026-06-11): asked to tweak the org's A2A mode, the
+ * model piped brigade.json through an inline python script and wrote it
+ * back. The operator approved the prompt without realizing it was a config
+ * WRITE; the script silently no-op'd (declared success, changed nothing),
+ * and only forensics caught it. A different bug in the same shape could
+ * have corrupted the whole install. `write`/`edit` are already guarded by
+ * the path-write guard — bash + python/sed/tee was the remaining hole.
+ *
+ * Boundary semantics (the operator's explicit ask): the agent may READ
+ * state files through the shell (discouraged — the tools report this state
+ * already), but every MUTATION must go through the proper tool surface
+ * (org / manage_provider / manage_agent / manage_skill / cron) or be
+ * handed to the operator as an exact suggested edit. The refusal text
+ * carries that remedy so the model course-corrects in one step.
+ */
+const BASH_TOOL_NAMES = new Set(["bash", "shell", "exec"]);
+/**
+ * A command is only inspected when it references a Brigade STATE path —
+ * a protected basename in a `.brigade` directory context. Bare mentions of
+ * `brigade.json` (e.g. developing Brigade itself in a repo checkout, or
+ * tempdir fixtures in tests) don't trip the guard.
+ */
+const STATE_PATH_RE = /(?:\$HOME|~|%USERPROFILE%|[A-Za-z]:[\\/](?:[^\s"']*[\\/])?)?\.brigade[\\/][^\s"'|;&]*?(brigade\.json|auth-profiles\.json|auth-state\.json|exec-approvals\.json|encryption\.key|cron\.json|models\.json|mode\.sentinel)/i;
+/** Write indicators evaluated only when a state path is referenced. */
+const WRITE_INDICATOR_RES = [
+    // python: json.dump( — but NOT json.dumps( (the read-and-print form).
+    { re: /json\.dump\s*\(/, label: "json.dump(...)" },
+    // python: open(..., "w"/"a"/"w+"/"wb"…)
+    { re: /open\s*\([^)]*['"][wa]\+?b?['"]/, label: "open(…, 'w')" },
+    // .write(...) / .writelines(...) — fh.write, stream.write, etc.
+    { re: /\.write(?:lines)?\s*\(/, label: ".write(...)" },
+    // pathlib: Path(...).write_text(...) / .write_bytes(...) — audit P1
+    // (these don't match `.write(` because of the underscore suffix).
+    { re: /\.write_(?:text|bytes)\s*\(/, label: ".write_text(...)" },
+    // node: fs.writeFileSync / fs.writeFile / fs.appendFileSync / .promises.writeFile
+    { re: /\b(?:write|append)File(?:Sync)?\s*\(/, label: "fs.writeFile(...)" },
+    // PowerShell .NET: [IO.File]::WriteAllText/WriteAllBytes/WriteAllLines
+    { re: /::Write(?:AllText|AllBytes|AllLines|AllLinesAsync)\b/i, label: "[IO.File]::WriteAll…" },
+    // shell redirect INTO a .brigade path
+    { re: />{1,2}\s*"?[^\s"'|;&]*\.brigade[\\/]/i, label: "redirect into ~/.brigade" },
+    // in-place editors / copiers targeting a .brigade path
+    { re: /\bsed\s+(-[a-zA-Z]*\s+)*-i\b/, label: "sed -i" },
+    { re: /\btee\s+(-a\s+)?"?[^\s"'|;&]*\.brigade[\\/]/i, label: "tee into ~/.brigade" },
+    { re: /\b(mv|cp)\s+\S+\s+"?[^\s"'|;&]*\.brigade[\\/]/i, label: "mv/cp into ~/.brigade" },
+    // PowerShell write cmdlets
+    { re: /\b(set-content|out-file|add-content)\b/i, label: "Set-Content/Out-File" },
+];
+/** Exposed for tests: classify a command. Returns the matched indicator or null. */
+export function detectConfigWrite(command) {
+    if (!STATE_PATH_RE.test(command))
+        return null;
+    for (const { re, label } of WRITE_INDICATOR_RES) {
+        if (re.test(command))
+            return label;
+    }
+    return null;
+}
+export function makeConfigWriteGuard() {
+    return async (ctx) => {
+        const rawName = ctx?.toolCall?.name ??
+            ctx?.name ??
+            "";
+        const name = typeof rawName === "string" ? rawName.trim().toLowerCase() : "";
+        if (!BASH_TOOL_NAMES.has(name))
+            return undefined;
+        const args = ctx
+            ?.toolCall?.arguments ??
+            ctx?.arguments ??
+            ctx?.args ??
+            {};
+        const command = args && typeof args === "object" && typeof args.command === "string"
+            ? args.command
+            : undefined;
+        if (!command)
+            return undefined;
+        const indicator = detectConfigWrite(command);
+        if (!indicator)
+            return undefined;
+        return {
+            block: true,
+            reason: `bash: refusing to modify a Brigade state file through the shell (detected ${indicator} ` +
+                "targeting ~/.brigade). A malformed shell write can corrupt the whole install — one such " +
+                "edit already silently failed in production while reporting success. Use the proper tool " +
+                "instead: org (hierarchy + a2a mode), manage_provider (API keys + per-agent models), " +
+                "manage_agent (agents), manage_skill (skills), cron (jobs). If no tool covers this change, " +
+                "tell the operator the exact edit to make in brigade.json — do not apply it yourself.",
+        };
+    };
+}
+//# sourceMappingURL=config-write-guard.js.map

package/dist/agents/config-write-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-write-guard.js","sourceRoot":"","sources":["../../src/agents/config-write-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,aAAa,GAClB,yNAAyN,CAAC;AAE3N,uEAAuE;AACvE,MAAM,mBAAmB,GAAyC;IACjE,sEAAsE;IACtE,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAClD,wCAAwC;IACxC,EAAE,EAAE,EAAE,iCAAiC,EAAE,KAAK,EAAE,cAAc,EAAE;IAChE,gEAAgE;IAChE,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,aAAa,EAAE;IACtD,oEAAoE;IACpE,kEAAkE;IAClE,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAChE,kFAAkF;IAClF,EAAE,EAAE,EAAE,sCAAsC,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC1E,uEAAuE;IACvE,EAAE,EAAE,EAAE,uDAAuD,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC9F,sCAAsC;IACtC,EAAE,EAAE,EAAE,uCAAuC,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAClF,uDAAuD;IACvD,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,QAAQ,EAAE;IACvD,EAAE,EAAE,EAAE,8CAA8C,EAAE,KAAK,EAAE,qBAAqB,EAAE;IACpF,EAAE,EAAE,EAAE,gDAAgD,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACxF,2BAA2B;IAC3B,EAAE,EAAE,EAAE,yCAAyC,EAAE,KAAK,EAAE,sBAAsB,EAAE;CAChF,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GACX,GAAyD,EAAE,QAAQ,EAAE,IAAI;YACzE,GAA0B,EAAE,IAAI;YACjC,EAAE,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAEjD,MAAM,IAAI,GACR,GAAmF;YACnF,EAAE,QAAQ,EAAE,SAAS;YACrB,GAA+B,EAAE,SAAS;YAC1C,GAA0B,EAAE,IAAI;YACjC,EAAE,CAAC;QACJ,MAAM,OAAO,GACZ,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA8B,CAAC,OAAO,KAAK,QAAQ;YAC9F,CAAC,CAAE,IAA4B,CAAC,OAAO;YACvC,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO;YACN,KAAK,EAAE,IAAI;YACX,MAAM,EACL,6EAA6E,SAAS,GAAG;gBACzF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,sFAAsF;gBACtF,4FAA4F;gBAC5F,sFAAsF;SACxD,CAAC;IAClC,CAAC,CAAC;AACH,CAAC"}

package/dist/agents/content-quality-retry.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Content-quality retry — after a turn settles, detects low-quality output and
+ * re-prompts with a tailored steer. Two tiers (see `runWithContentQualityRetry`):
+ *   - RECOVERY ("said it would act but didn't" / "reasoning but no visible reply" /
+ *     "empty") → exactly ONE re-prompt (one retry recovers the common cases; looping
+ *     a pathological empty turn would just burn budget).
+ *   - QUALITY GATE (slop) → keeps forcing a rewrite until the reply clears the slop
+ *     bar or a cap (default 3), so a sloppy reply can't ship after a single nudge.
+ *
+ * The slop cap bounds the compounded budget across the other retry layers
+ * (model-fallback + retry-policy + stream-wrappers).
+ *
+ * Failure modes:
+ *   - **empty** — no content blocks at all
+ *   - **reasoning-only** — thinking blocks present but no visible text
+ *     OR tool call (the user sees a blank reply)
+ *   - **planning-only** — text matches a "I'll do X" pattern AND no tool
+ *     was invoked. Only flagged when tools are actually available.
+ *
+ * Ported from `core/agent.ts:1140-1248` (Runtime A) — same logic, no
+ * functional change. Lives here so Runtime B can call it without
+ * importing from Runtime A.
+ */
+import type { AgentSession } from "@mariozechner/pi-coding-agent";
+export type ContentQualityIssue = "empty" | "reasoning-only" | "planning-only" | "slop" | null;
+/**
+ * Inspect an assistant message for low-quality content. Returns the
+ * issue type or null. Public for tests; the wrapper below calls it.
+ *
+ * `hadTools` should be `true` when the session has tools registered —
+ * planning-only is only meaningful in that case (without tools, "I'll
+ * write the code" IS the deliverable).
+ */
+export declare function detectContentIssue(message: {
+    role?: string;
+    content?: unknown;
+} | null | undefined, hadTools: boolean): ContentQualityIssue;
+export interface ContentQualityRetryOptions {
+    /** Called when a retry is triggered, with the detected reason. */
+    onRetry?: (reason: NonNullable<ContentQualityIssue>) => void;
+    /** Max rewrite re-prompts for the QUALITY (slop) gate. The gate keeps forcing a
+     *  rewrite until the reply clears the slop bar OR this cap is hit — then it ships the
+     *  last attempt (a response must go out eventually). Default 3. The RECOVERY issues
+     *  (empty / reasoning-only / planning-only) always get exactly ONE re-prompt,
+     *  regardless of this value — looping those is pathological, not a quality bar. */
+    maxSlopRewrites?: number;
+}
+/**
+ * Run a prompt body. After it resolves, inspect the final assistant message for
+ * low-quality content; if detected, re-prompt with a tailored steer.
+ *
+ * Two tiers:
+ *   - RECOVERY (empty / reasoning-only / planning-only) → exactly ONE re-prompt.
+ *     One retry recovers the common cases; looping a pathological empty turn would
+ *     just burn budget.
+ *   - QUALITY GATE (slop) → keeps forcing a rewrite until the reply clears the slop
+ *     bar or `maxSlopRewrites` (default 3) is hit. This is the "no slop ships" gate:
+ *     a single sloppy reply can't slip through after one nudge — it's re-driven until
+ *     clean (or, at the cap, the last attempt ships, since a response must go out).
+ *
+ * Composes with the other retry layers (model-fallback, retry-policy, thinking-
+ * fallback) — the slop cap bounds the compounded budget. Each retry is a fresh
+ * `session.prompt()` with the steer text (provider-portable, not a prefill).
+ */
+export declare function runWithContentQualityRetry(session: AgentSession, body: () => Promise<void>, options?: ContentQualityRetryOptions): Promise<void>;
+//# sourceMappingURL=content-quality-retry.d.ts.map

package/dist/agents/content-quality-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-quality-retry.d.ts","sourceRoot":"","sources":["../../src/agents/content-quality-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAIlE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,gBAAgB,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,CAAC;AAsC/F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAChE,QAAQ,EAAE,OAAO,GACf,mBAAmB,CA2CrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC;IAC7D;;;;uFAImF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/agents/content-quality-retry.js

@@ -0,0 +1,140 @@
+/**
+ * Content-quality retry — after a turn settles, detects low-quality output and
+ * re-prompts with a tailored steer. Two tiers (see `runWithContentQualityRetry`):
+ *   - RECOVERY ("said it would act but didn't" / "reasoning but no visible reply" /
+ *     "empty") → exactly ONE re-prompt (one retry recovers the common cases; looping
+ *     a pathological empty turn would just burn budget).
+ *   - QUALITY GATE (slop) → keeps forcing a rewrite until the reply clears the slop
+ *     bar or a cap (default 3), so a sloppy reply can't ship after a single nudge.
+ *
+ * The slop cap bounds the compounded budget across the other retry layers
+ * (model-fallback + retry-policy + stream-wrappers).
+ *
+ * Failure modes:
+ *   - **empty** — no content blocks at all
+ *   - **reasoning-only** — thinking blocks present but no visible text
+ *     OR tool call (the user sees a blank reply)
+ *   - **planning-only** — text matches a "I'll do X" pattern AND no tool
+ *     was invoked. Only flagged when tools are actually available.
+ *
+ * Ported from `core/agent.ts:1140-1248` (Runtime A) — same logic, no
+ * functional change. Lives here so Runtime B can call it without
+ * importing from Runtime A.
+ */
+import { detectSlop } from "./quality/slop-detector.js";
+/**
+ * Sentence-start anchor — `(?:^|[.!?\n]\s+)`. Used by every planning-phrase
+ * pattern below so the matcher fires only when the phrase opens a sentence,
+ * not when it appears inside a quoted user message ("the user said 'I'll
+ * fix it' which means..."). Without this anchor, the assistant echoing
+ * the user's own intent would falsely trigger a retry.
+ */
+const SENTENCE_START = "(?:^|[.!?\\n]\\s+)";
+const PLANNING_PHRASES = [
+    new RegExp(`${SENTENCE_START}i'?ll (?:create|write|build|make|generate|set up|implement|fix|update|add|do|run|execute|launch|deploy|install|configure)`, "i"),
+    new RegExp(`${SENTENCE_START}let me (?:create|write|build|make|generate|implement|fix|update|add|do|run|execute|launch|deploy|install|configure)`, "i"),
+    new RegExp(`${SENTENCE_START}(?:going to|i will|i shall) (?:create|write|build|make|generate|implement)`, "i"),
+    new RegExp(`${SENTENCE_START}here'?s (?:what|how) i'?ll`, "i"),
+];
+const STEER_FOR = {
+    empty: "You returned no visible reply. Provide your full visible answer to the user's last message now, in plain text.",
+    "reasoning-only": "You produced reasoning but no visible answer. Provide your final visible answer to the user now, in plain text outside of any reasoning blocks.",
+    "planning-only": "You described an action you would take, but you did not actually invoke the tool to do it. Take the action now using the appropriate tool — do not just describe it again.",
+    slop: "Your reply leaned on filler / cliché phrasing (formulaic openers, empty intensifiers, boilerplate). Rewrite it concretely and concisely — keep the substance, drop the padding.",
+};
+/**
+ * Inspect an assistant message for low-quality content. Returns the
+ * issue type or null. Public for tests; the wrapper below calls it.
+ *
+ * `hadTools` should be `true` when the session has tools registered —
+ * planning-only is only meaningful in that case (without tools, "I'll
+ * write the code" IS the deliverable).
+ */
+export function detectContentIssue(message, hadTools) {
+    if (!message || message.role !== "assistant")
+        return null;
+    const content = message.content;
+    if (!Array.isArray(content) || content.length === 0)
+        return "empty";
+    const textBlocks = content.filter((b) => b && typeof b === "object" && b.type === "text"
+        && typeof b.text === "string");
+    const thinkingBlocks = content.filter((b) => b && typeof b === "object" && b.type === "thinking");
+    const toolCallBlocks = content.filter((b) => b && typeof b === "object" && b.type === "toolCall");
+    const totalText = textBlocks
+        .map((b) => b.text)
+        .join("")
+        .trim();
+    // Reasoning-only: had thinking blocks, no text, no tool call.
+    if (thinkingBlocks.length > 0 && totalText.length === 0 && toolCallBlocks.length === 0) {
+        return "reasoning-only";
+    }
+    // Empty: zero text AND zero tool calls (and not reasoning-only above).
+    if (totalText.length === 0 && toolCallBlocks.length === 0)
+        return "empty";
+    // Planning-only: only matters when tools were available — otherwise the
+    // model has no choice. We check that the text matches a planning phrase
+    // AND no tool was invoked in this final message.
+    if (hadTools && toolCallBlocks.length === 0 && totalText.length > 0) {
+        if (PLANNING_PHRASES.some((re) => re.test(totalText)))
+            return "planning-only";
+    }
+    // Slop (the post-generation quality gate) — LOWEST priority, only on a visible
+    // text reply that isn't otherwise broken. The detector's density threshold keeps
+    // this rare (it takes several distinct filler/cliché hits to trip); the wrapper
+    // then re-drives a rewrite until the reply clears the bar or the cap.
+    if (totalText.length > 0 && detectSlop(totalText).isSlop)
+        return "slop";
+    return null;
+}
+/**
+ * Run a prompt body. After it resolves, inspect the final assistant message for
+ * low-quality content; if detected, re-prompt with a tailored steer.
+ *
+ * Two tiers:
+ *   - RECOVERY (empty / reasoning-only / planning-only) → exactly ONE re-prompt.
+ *     One retry recovers the common cases; looping a pathological empty turn would
+ *     just burn budget.
+ *   - QUALITY GATE (slop) → keeps forcing a rewrite until the reply clears the slop
+ *     bar or `maxSlopRewrites` (default 3) is hit. This is the "no slop ships" gate:
+ *     a single sloppy reply can't slip through after one nudge — it's re-driven until
+ *     clean (or, at the cap, the last attempt ships, since a response must go out).
+ *
+ * Composes with the other retry layers (model-fallback, retry-policy, thinking-
+ * fallback) — the slop cap bounds the compounded budget. Each retry is a fresh
+ * `session.prompt()` with the steer text (provider-portable, not a prefill).
+ */
+export async function runWithContentQualityRetry(session, body, options = {}) {
+    await body();
+    // Inspect the LAST assistant message off a fresh snapshot each call — async
+    // subscribers (extension hooks, telemetry) could append between a prompt
+    // resolving and our inspection, so "last assistant" must be re-read, not cached.
+    const inspectLast = () => {
+        const snapshot = [...session.messages];
+        const tools = session.agent.state.tools;
+        const hadTools = Array.isArray(tools) && tools.length > 0;
+        const lastAssistant = [...snapshot].reverse().find((m) => m.role === "assistant");
+        return detectContentIssue(lastAssistant, hadTools);
+    };
+    const issue = inspectLast();
+    if (!issue)
+        return;
+    // RECOVERY issues — a single steer re-prompt (Pi's `agent.steer` is for mid-turn
+    // injection; this fires AFTER the turn, so we re-prompt directly).
+    if (issue !== "slop") {
+        options.onRetry?.(issue);
+        await session.prompt(STEER_FOR[issue]);
+        return;
+    }
+    // QUALITY GATE (slop) — force a rewrite, re-check, and keep going until the reply
+    // clears the bar or the cap. "No slop ships" within budget.
+    const maxRewrites = Math.max(1, options.maxSlopRewrites ?? 3);
+    for (let attempt = 0; attempt < maxRewrites; attempt++) {
+        options.onRetry?.("slop");
+        await session.prompt(STEER_FOR.slop);
+        if (inspectLast() !== "slop")
+            return; // cleared the bar — ship it
+    }
+    // Hit the cap with the reply still flagged — ship the last attempt (a response
+    // must go out eventually; the gate forced `maxRewrites` rewrites trying to clear it).
+}
+//# sourceMappingURL=content-quality-retry.js.map

package/dist/agents/content-quality-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-quality-retry.js","sourceRoot":"","sources":["../../src/agents/content-quality-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAIxD;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,MAAM,gBAAgB,GAAG;IACxB,IAAI,MAAM,CACT,GAAG,cAAc,2HAA2H,EAC5I,GAAG,CACH;IACD,IAAI,MAAM,CACT,GAAG,cAAc,qHAAqH,EACtI,GAAG,CACH;IACD,IAAI,MAAM,CACT,GAAG,cAAc,4EAA4E,EAC7F,GAAG,CACH;IACD,IAAI,MAAM,CAAC,GAAG,cAAc,4BAA4B,EAAE,GAAG,CAAC;CAC9D,CAAC;AAEF,MAAM,SAAS,GAAqD;IACnE,KAAK,EACJ,gHAAgH;IACjH,gBAAgB,EACf,iJAAiJ;IAClJ,eAAe,EACd,4KAA4K;IAC7K,IAAI,EACH,iLAAiL;CAClL,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAgE,EAChE,QAAiB;IAEjB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,MAAM;WAC1E,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ,CACtD,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,UAAU,CAClF,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAwB,CAAC,IAAI,KAAK,UAAU,CAClF,CAAC;IAEF,MAAM,SAAS,GAAG,UAAU;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsB,CAAC,IAAI,CAAC;SACxC,IAAI,CAAC,EAAE,CAAC;SACR,IAAI,EAAE,CAAC;IAET,8DAA8D;IAC9D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,OAAO,gBAAgB,CAAC;IACzB,CAAC;IAED,uEAAuE;IACvE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE1E,wEAAwE;IACxE,wEAAwE;IACxE,iDAAiD;IACjD,IAAI,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,eAAe,CAAC;IAC/E,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,sEAAsE;IACtE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAExE,OAAO,IAAI,CAAC;AACb,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAAqB,EACrB,IAAyB,EACzB,UAAsC,EAAE;IAExC,MAAM,IAAI,EAAE,CAAC;IAEb,4EAA4E;IAC5E,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,WAAW,GAAG,GAAwB,EAAE;QAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAI,OAAO,CAAC,KAAK,CAAC,KAA6B,CAAC,KAAK,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACrG,OAAO,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,iFAAiF;IACjF,mEAAmE;IACnE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO;IACR,CAAC;IAED,kFAAkF;IAClF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IAC9D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,CAAC,4BAA4B;IACnE,CAAC;IACD,+EAA+E;IAC/E,sFAAsF;AACvF,CAAC"}

package/dist/agents/error-classifier.d.ts

@@ -0,0 +1,89 @@
+export type RetryReason = "auth" | "auth_permanent" | "format" | "rate_limit" | "overloaded" | "billing" | "timeout" | "context_overflow" | "model_not_found" | "session_expired" | "unknown";
+export interface ClassificationContext {
+    provider?: string;
+    model?: string;
+}
+export declare class BrigadeRetryError extends Error {
+    readonly reason: RetryReason;
+    readonly status?: number;
+    readonly code?: string;
+    readonly provider?: string;
+    readonly model?: string;
+    constructor(args: {
+        message: string;
+        reason: RetryReason;
+        status?: number;
+        code?: string;
+        provider?: string;
+        model?: string;
+        cause?: unknown;
+    });
+}
+export declare function isBrigadeRetryError(value: unknown): value is BrigadeRetryError;
+/**
+ * RetryReason classifier. Returns one of the 11 retry-policy categories so
+ * `getRetryPolicy(reason)` can pick the right backoff / rotation strategy.
+ *
+ * NOTE: there is a SECOND classifier in this file (`classifyErrorDetailed`)
+ * that returns a richer object shape used by the lifted v0.1.3 wrappers in
+ * `core/agent.ts`. They are NOT interchangeable — the names differ
+ * deliberately so a future careless edit can't swap them silently.
+ *
+ * For an alias view, `core/agent.ts` imports `classifyErrorDetailed as
+ * classifyError` — that's its OWN file's local name, not the one exported
+ * here. This file's `classifyError` always returns a string RetryReason.
+ */
+export declare function classifyErrorReason(value: unknown, _ctx?: ClassificationContext): RetryReason;
+export declare function scrubAnthropicRefusalSentinel(text: string): string;
+export declare function summariseError(value: unknown): string;
+export type ErrorClass = "rate_limit" | "server_5xx" | "network" | "timeout" | "context_overflow" | "auth" | "auth_permanent" | "content_filter" | "model_not_found" | "unknown";
+export interface ClassifiedError {
+    /** The class. Drives which recovery the loop attempts. */
+    class: ErrorClass;
+    /** Retry-After delay in ms, parsed from the message if the provider included one. */
+    retryAfterMs?: number;
+    /** Original error message, for logging. */
+    message: string;
+    /** True if the same MODEL might succeed on retry; false → advance to fallback. */
+    retryableOnSameModel: boolean;
+}
+/**
+ * Detailed classifier (object return) used by the retry-policy ladder.
+ * Returns `{class, retryAfterMs?, message, retryableOnSameModel}` —
+ * `decideRetry` reads these fields to pick a backoff strategy.
+ *
+ * Use `classifyError` (above) when you only need the category string.
+ */
+export declare function classifyErrorDetailed(err: unknown): ClassifiedError;
+export interface RetryDecision {
+    /** True → caller should retry on the same model after the given delay. */
+    retry: boolean;
+    /** Delay before retry in ms. Always >= 0. Ignored when retry=false. */
+    delayMs: number;
+    /** Reason string for logging / UI. */
+    reason: string;
+}
+export interface RetryPolicyOptions {
+    /** Which attempt number is this (1-indexed). Starts at 1 for the FIRST retry. */
+    attempt: number;
+    /** Hard cap on total retries before giving up on the same model. */
+    maxAttempts?: number;
+    /** Cap on total wait per single retry. */
+    maxDelayMs?: number;
+}
+/**
+ * Decide what to do with a classified error. Returns the next backoff and
+ * whether to retry on the same model. Cooldown ladder: 30s → 60s → 5min.
+ *
+ * `context_overflow` is special: caller should run smart compaction BEFORE
+ * retrying — delay is 0 because we're not waiting on the network, we're
+ * waiting on local work.
+ */
+export declare function decideRetry(c: ClassifiedError, opts: RetryPolicyOptions): RetryDecision;
+/**
+ * Parse Retry-After. Providers express this as either a delta-seconds integer
+ * or an HTTP-date string per RFC 7231; we accept both. Exported so callers
+ * (tests, the model-fallback orchestrator) can read the same hint.
+ */
+export declare function parseRetryAfter(err: unknown): number | undefined;
+//# sourceMappingURL=error-classifier.d.ts.map

package/dist/agents/error-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-classifier.d.ts","sourceRoot":"","sources":["../../src/agents/error-classifier.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,gBAAgB,GAChB,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CASF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAI9E;AAkLD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,WAAW,CAuE7F;AA8CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlE;AAOD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAarD;AAqBD,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,MAAM,GACN,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,UAAU,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAgFD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAiFnE;AAID,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,GAAG,aAAa,CAsCvF;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAmBhE"}